Overview

overview

10

Static

static

3

data643exe.exe

windows7-x64

10

data643exe.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    data643exe.exe

  • Size

    364KB

  • Sample

    230701-jpbw4ahb8s

  • MD5

    849a5ce45c4c4d6ff905454cb4def6d0

  • SHA1

    e7a108de4f5bc1d4df02a54f7feab3bd7fe07540

  • SHA256

    5b0571f8a88305984bc085c613c36bd12c8ba7539b1429e7302808c228ed89f0

  • SHA512

    e7d39db1c07c5aabfda5882e745e27fe8e13bc21b3d851428831fe37cc615d67f48fa2d793d93ba3a8eef1e275499eecd6fb7a2d68bfebcbe6818461bd2548de

  • SSDEEP

    6144:Gr2BjzIgdCCsdNXH/Fopo+CFLbyoSfl8NSoA4XvF1RNhfgs:GMST9GOLmJfl9o9X9Xss

Score
10/10
vidar1680stealer

Malware Config

Extracted

Family

vidar

Version

55

Botnet

1680

C2

https://t.me/truewallets

https://mas.to/@zara99

http://116.203.10.3:80
Attributes
  • profile_id

    1680

Targets

    • Target

      data643exe.exe

    • Size

      364KB

    • MD5

      849a5ce45c4c4d6ff905454cb4def6d0

    • SHA1

      e7a108de4f5bc1d4df02a54f7feab3bd7fe07540

    • SHA256

      5b0571f8a88305984bc085c613c36bd12c8ba7539b1429e7302808c228ed89f0

    • SHA512

      e7d39db1c07c5aabfda5882e745e27fe8e13bc21b3d851428831fe37cc615d67f48fa2d793d93ba3a8eef1e275499eecd6fb7a2d68bfebcbe6818461bd2548de

    • SSDEEP

      6144:Gr2BjzIgdCCsdNXH/Fopo+CFLbyoSfl8NSoA4XvF1RNhfgs:GMST9GOLmJfl9o9X9Xss

    Score
    10/10
    vidar1680stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks